test/fix: address review — robust absolute-path test and tolerant reads

- register_commands(): use is_file() instead of exists() and skip the
  command if read_text() raises (directory or non-UTF8 file), aligning
  with the other command/skill readers.
- Traversal tests: point the absolute-path payload at the real temp
  secret.txt (guaranteed to exist on all platforms) instead of
  /etc/passwd, so the absolute-path guard is genuinely exercised and the
  test fails if it regresses, rather than passing because the target
  happens not to exist (e.g. on Windows runners).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: mnriem

src/specify_cli/agents.py

@@ -562,10 +562,13 @@ def register_commands(
             except (OSError, ValueError):
                 continue
 
-            if not source_file.exists():
+            if not source_file.is_file():
                 continue
 
-            content = source_file.read_text(encoding="utf-8")
+            try:
+                content = source_file.read_text(encoding="utf-8")
+            except (OSError, UnicodeDecodeError):
+                continue
             frontmatter, body = self.parse_frontmatter(content)
 
             if frontmatter.get("strategy") == "wrap":

tests/test_registrar_path_traversal.py

@@ -135,14 +135,27 @@ def test_rejects_traversal_names(self, tmp_path, bad_name):
         _assert_no_stray_files(tmp_path, Path(bad_name).name.replace("/", ""))
 
 
+ABS_SECRET = "__ABS_SECRET__"
+
 FILE_FIELD_PAYLOADS = [
     "../secret.txt",
     "../../secret.txt",
     "commands/../../secret.txt",
-    "/etc/passwd",
+    ABS_SECRET,
 ]
 
 
+def _resolve_payload(bad_file: str, secret: Path) -> str:
+    """Map the absolute-path sentinel to the real, existing secret file.
+
+    Using the temp secret's own absolute path (instead of ``/etc/passwd``)
+    guarantees the file exists on every platform — so the test fails if the
+    absolute-path guard regresses, rather than passing because the target
+    happens not to exist (e.g. on Windows runners).
+    """
+    return str(secret) if bad_file == ABS_SECRET else bad_file
+
+
 class TestCommandFileTraversal:
     """The manifest ``file`` field must not read host files outside source_dir.
 
@@ -163,7 +176,7 @@ def test_claude_skips_traversal_in_file_field(self, tmp_path, bad_file):
         registrar = CommandRegistrar()
         registered = registrar.register_commands(
             "claude",
-            [{"name": "speckit.myext.hello", "file": bad_file, "aliases": []}],
+            [{"name": "speckit.myext.hello", "file": _resolve_payload(bad_file, secret), "aliases": []}],
             "myext",
             ext_dir,
             project,
@@ -187,7 +200,7 @@ def test_gemini_skips_traversal_in_file_field(self, tmp_path, bad_file):
         registrar = CommandRegistrar()
         registered = registrar.register_commands(
             "gemini",
-            [{"name": "speckit.myext.hello", "file": bad_file, "aliases": []}],
+            [{"name": "speckit.myext.hello", "file": _resolve_payload(bad_file, secret), "aliases": []}],
             "myext",
             ext_dir,
             project,